CVE-2025-20337
Cisco Identity Services Engine Injection Vulnerability
Description
CVE-2025-20337 is a critical-severity injection vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that allows an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The vulnerability is caused by insufficient validation of user-supplied input in a specific API endpoint. With the maximum possible CVSS v3.1 score of 10.0 and a changed scope, this vulnerability represents one of the most severe security flaws possible, enabling complete system compromise without any authentication. CISA has added CVE-2025-20337 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 18, 2025, and the EPSS score of 0.58% at the 68th percentile suggests exploitation is still ramping up.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | identity services engine | 3.3.0; 3.4.0 |
| cisco | identity services engine passive identity connector | 3.3.0; 3.4.0 |
References
Weakness Type
CWE-74: Injection
CVE-2025-20337 is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly known as Injection). This weakness occurs when software constructs output using external input without properly neutralizing special elements that could be interpreted as control instructions by a downstream interpreter. In Cisco ISE, a specific API endpoint fails to validate user-supplied input, allowing an attacker to inject elements that are interpreted as commands by the underlying operating system.
Learn more: CWE-74 — Injection
Impact Analysis
CVE-2025-20337 represents the most severe possible vulnerability profile with a perfect CVSS score of 10.0. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N), and has changed scope (S:C) meaning exploitation affects resources well beyond the vulnerable component. Confidentiality (High): root-level access to Cisco ISE exposes the entire network access control infrastructure, including RADIUS secrets, authentication credentials for all network devices, user identity data, certificate stores, and policy configurations that govern network access across the enterprise. Integrity (High): as root, the attacker can modify network access policies to grant unauthorized access to any network segment, inject rogue devices into trusted networks, alter audit logs, and install persistent backdoors. Availability (High): the attacker can disable network access control entirely, lock out legitimate users and devices, or disrupt authentication services causing widespread network outages. Cisco ISE is typically a core component of enterprise network security architecture, making its compromise a catastrophic event that undermines the entire trust model of the network.
Exploit Maturity
CVE-2025-20337 has been confirmed as actively exploited in the wild, evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of August 18, 2025. The EPSS score of 0.58% at the 68th percentile suggests that while exploitation is occurring, it has not yet reached the widespread automated scanning level, consistent with targeted attacks against high-value Cisco ISE deployments rather than opportunistic mass exploitation. Cisco ISE systems are prime targets for sophisticated threat actors because they serve as the central network access control authority, and compromising ISE provides the attacker with the ability to manipulate network authentication and authorization policies across the entire enterprise. The Cisco Security Advisory provides technical details and patching guidance.
Remediation
-
Apply the Cisco ISE security patch immediately. Refer to the Cisco Security Advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6 for specific patch versions addressing CVE-2025-20337. ISE versions 3.3.0 and 3.4.0, as well as corresponding ISE-PIC versions, require updates.
-
Restrict network access to ISE administration and API interfaces by implementing firewall rules that limit access to trusted management networks only. The vulnerable API endpoint should not be accessible from untrusted networks under any circumstances.
-
Conduct a thorough forensic investigation of all ISE nodes to determine if exploitation has already occurred. Check for unauthorized configuration changes, new administrator accounts, modified access policies, suspicious API activity, and evidence of root-level access. Review RADIUS and TACACS+ logs for anomalies.
-
Rotate all credentials managed by ISE including RADIUS shared secrets, TACACS+ keys, certificate private keys, and LDAP/AD service account credentials. If the ISE server was compromised, all secrets it stored or transmitted should be considered exposed.
-
Implement network segmentation to isolate ISE infrastructure within a dedicated, highly restricted management zone. Deploy intrusion detection systems monitoring traffic to and from ISE nodes, with specific alerting for unexpected API access patterns and anomalous authentication behavior.
Technical Details
CVE-2025-20337 is an injection vulnerability in a specific API of Cisco ISE and ISE-PIC that enables unauthenticated remote code execution as root. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum score of 10.0, reflecting the most severe vulnerability characteristics: network accessibility, low complexity, no authentication, no user interaction, changed scope, and maximum impact across all three CIA dimensions. The vulnerability is caused by insufficient validation of user-supplied input in an API endpoint. An attacker can submit a crafted API request containing injection payloads that the ISE application fails to sanitize before passing them to the underlying operating system. Because the ISE service runs with root privileges, the injected commands execute with full system access, providing the attacker with unrestricted control over the ISE node and its configuration. Affected versions include Cisco ISE 3.3.0 and 3.4.0, as well as Cisco ISE Passive Identity Connector 3.3.0 and 3.4.0. The CWE-74 classification encompasses the general injection pattern where user input is incorporated into commands or queries without proper neutralization.
Frequently Asked Questions
Is CVE-2025-20337 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2025-20337 to the KEV catalog with a remediation deadline of August 18, 2025. The critical severity and unauthenticated remote code execution as root make this one of the most dangerous actively exploited vulnerabilities.
What products are affected by CVE-2025-20337?
Cisco Identity Services Engine (ISE) versions 3.3.0 and 3.4.0, and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.3.0 and 3.4.0 are affected.
How do I fix CVE-2025-20337?
Apply the security patch from Cisco as documented in the advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6. Additionally, restrict API access to trusted networks, conduct forensic investigation, and rotate all credentials managed by ISE.
How severe is CVE-2025-20337?
CVE-2025-20337 has the maximum possible CVSS v3.1 score of 10.0 (Critical). It allows unauthenticated remote code execution as root with changed scope, meaning it can affect the entire network infrastructure managed by ISE.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.